Is the 60-day rule a Medicaid requirement too, or only a Medicare one?

Both. The statute reaches money paid under Medicare and under Medicaid, and the people it covers include providers, suppliers, and plans that run Medicaid managed care. CMS wrote a detailed regulation for Medicare Parts A and B. For Medicaid, the statute applies directly, and the reporting steps come from your state and from your broker or plan contract.

If the broker made the billing error, do I still have to return the money?

Yes. Under the statute, an overpayment is money you took in or held onto without being entitled to it once accounts are reconciled. Whose mistake caused it does not change that. Report it to the broker or plan in writing with the reason, and return it the way your contract describes, usually by an adjustment or offset.

Is voiding the claim enough to satisfy the rule?

Not always. New York's inspector general is clear that a void or adjustment alone leaves the reporting and explanation still owed. Routine errors that were already voided go through its short disclosure process, and larger ones through the full process. Indiana handles routine errors by void or adjustment, but asks for a disclosure form for system errors, possible rule violations, and overpayments over $1,000.

How far back do I have to look once I find a problem?

Follow your state's rule and your contracts. New York's self-disclosure program uses a six-year lookback by date of service. The Medicare regulation also reaches overpayments identified within six years of when they were received. Your review should cover every claim with the same cause inside that window, not just the claim that surfaced.

Will I pay a penalty if I report on time?

A routine overpayment reported and returned on time is normally just repaid. Pennsylvania, for example, accepts repayment without penalty when the underlying conduct was not fraudulent. Matters involving possible fraud are different: settlements through the HHS OIG self-disclosure process generally require a multiple of at least 1.5 on single damages, and never less than $20,000.

Can a biller or dispatcher report the company for keeping an overpayment?

Yes. Under the False Claims Act, a private person can file a lawsuit on the government's behalf. If the government takes over the case, that person receives 15% to 25% of the recovery, and 25% to 30% if they pursue it alone. The law also protects employees who are fired, demoted, or harassed for working to stop a violation.

Medicaid Overpayment 60-Day Rule for NEMT (2026)

Billing mistakes happen in every transportation company. A dispatcher codes a wheelchair trip for a rider who walked, a no-show goes out as a completed trip, or a broker pays the same trip twice. Honest mistakes like these are not fraud. Keeping the money once you know about it can be. You have 60 days under federal law from identifying an overpayment to disclose it, repay it, and put the cause in writing. This guide covers what the rule requires, when the clock starts, where the money goes, and what happens when the deadline passes, current to September 2026.

The statute in plain terms

Congress added the rule in March 2010, in section 6402(a) of the Affordable Care Act (Pub. L. 111-148), and it now sits in the Social Security Act at 42 U.S.C. 1320a-7k(d). Anyone covered who receives an overpayment has three duties:

Report the overpayment to whoever is appropriate: HHS, the state, or the contractor that paid it.
Return the money.
Explain the reason for the overpayment in writing.

The deadline is 60 days after identification, or the due date of a related cost report if that comes later. Without a cost report, the deadline is 60 days.

The law reaches funds received under Medicare and Medicaid. It covers providers of services and suppliers, Medicaid managed care organizations, Medicare Advantage plans, and Part D drug plan sponsors. Beneficiaries are excluded. An overpayment means funds you took in or held onto that, once reconciled, you have no right to. Fault does not matter. A payer’s processing error counts the same as your own.

Common NEMT overpayments

These examples show the kinds of errors that create an obligation to report and return:

Example	Why it is an overpayment
A trip billed at the wheelchair rate for an ambulatory rider	Paid at a higher-paying service level than the rider received
Loaded miles billed above what the route actually required	Paid for miles not driven with the rider
A no-show or cancelled trip billed as completed	Paid for a ride that never took place
The same trip paid twice, or paid by both a broker and the state	Duplicate payment
A trip run by a driver who did not meet the payer’s driver rules that day	New York, for example, disallows ambulette claims when the driver was missing from the company’s required driver report
Medicaid paid, and later another insurer paid for the same trip	Indiana treats the later payment from another insurer as a Medicaid overpayment to adjust

Our guide to corrected NEMT claims explains fixing errors you catch before payment.

When the clock starts

The statute says the clock runs from when the overpayment was identified, but it does not define identified. For Medicare Parts A and B, CMS defined it by regulation, and the current version took effect January 1, 2025 (42 CFR 401.305):

A provider has identified an overpayment when it knowingly receives or retains one, with knowingly defined as in the False Claims Act.
Under that meaning, actual knowledge is not required. Deliberate ignorance of the truth, or reckless disregard for it, is enough, and no intent to defraud has to be shown (31 U.S.C. 3729(b)).
The deadline is suspended while the provider promptly investigates, in good faith, whether other overpayments share the same cause, for up to 180 days from the first identification.
Overpayments must be reported if identified within six years of when they were received.

The regulation applies only to Medicare Part A and Part B (42 CFR 401.301). Medicaid relies on the statute itself, and states and managed care contracts set the process. New York’s inspector general, for example, uses a six-year lookback by date of service for self-disclosures.

The practical reading is the same everywhere. Once you have real information that a payment may be wrong, start looking into it and write down the date. Ignoring a red flag does not stop the clock under the knowing standard.

Where to report and return

Report to whoever paid the trip, using the process that payer has set up.

Who paid	Where the overpayment goes	Notes
The state, paying directly (fee-for-service)	The state’s void, adjustment, or self-disclosure process	Indiana handles routine errors by void or adjustment, and asks for its self-disclosure form when a billing system caused the error, when law or policy may have been broken, or when the total tops $1,000. Do not send money with Indiana’s form; the state confirms the amount first.
A health plan or broker	The plan’s overpayment process under your contract	Federal rules require every plan to offer network providers a process to report an overpayment, repay it within 60 calendar days, and explain it in writing (42 CFR 438.608). New York steers managed care network providers to disclose to their plan. Pennsylvania wants payments returned to the plan and the disclosure made to the state as well.
Any payer, where the facts suggest possible fraud	Legal advice first, then a formal self-disclosure	The HHS OIG protocol accepts only matters involving potential fraud, not simple overpayments or errors. State inspectors general run their own programs.

Voiding a claim may not be enough

A void or adjustment returns the money, but it may not report and explain it. New York’s inspector general states that a void or adjustment, by itself, does not meet the obligation to report and explain. Its short disclosure process is for routine errors already voided or adjusted, and a full disclosure is required for errors with a substantial money or program impact. New York has no dollar threshold for reporting, and a full disclosure pauses the 60-day clock until the state issues its determination.

Pennsylvania’s protocol lets a provider either review 100% of the affected claims or project the error from a sample under a work plan the state approves. If nothing fraudulent happened, Pennsylvania takes the repayment with no penalty and no double damages.

The OIG self-disclosure protocol

The HHS OIG Self-Disclosure Protocol (2021) is for potential fraud that could bring civil monetary penalties, such as billing for trips that never happened or paying for referrals. OIG generally settles at no less than 1.5 times single damages, with a floor of $100,000 for kickback matters and $20,000 for all others. Under the Medicare regulation, the repayment deadline is suspended once OIG acknowledges receiving the submission. Do not file one without legal advice.

What happens after 60 days

Once the deadline passes, a kept overpayment is treated as an obligation for False Claims Act purposes. The overpayment statute says this outright, and the Act’s own definition of obligation includes the retention of any overpayment (31 U.S.C. 3729). Knowingly dodging or shrinking a debt owed to the government violates the Act, which is often called a reverse false claim.

Exposure	Amount
Civil penalty under the False Claims Act	For penalties imposed after July 3, 2025: a $14,308 minimum and $28,619 maximum per violation, which the Justice Department kept for 2026 (28 CFR 85.5)
False Claims Act damages	Three times the government’s damages, which a court can reduce to two times in some cases
Civil money penalty for knowing of an overpayment and not reporting and returning it	A cap of $25,595 per item or service, as last adjusted for inflation (45 CFR 102.3)
New York state penalty	As much as $10,000 per item or service, rising to $30,000 when the provider was penalized in the prior five years

For example, on an error that touched 500 trips, per-claim penalties add up quickly, and they come on top of repaying the money.

Whistleblowers raise the stakes. Anyone, employees included, may bring a False Claims Act suit for the government and share in the recovery: 15% to 25% when the government joins, and 25% to 30% when it does not (31 U.S.C. 3730). Employees who are fired, demoted, or harassed for acting to stop a violation are entitled to be made whole. Read the False Claims Act entry for more.

How a report affects the state

Your written report also starts a clock for the state. Under federal rules, a non-fraud overpayment is discovered on the earliest of several dates, including the first day a provider tells the Medicaid agency in writing that it was overpaid a stated amount (42 CFR 433.316). The state then has a year to collect before the federal share comes due to CMS. Expect the state to act on your report and move to collect. See Medicaid recoupment for how collection works.

A working 60-day plan

This example timeline shows how a small company can work through a problem inside the deadline.

Day 1: log it. Write down what surfaced, who found it, and the date. The trigger might be a driver’s comment, a complaint, a broker’s audit finding, or your own review.
Days 1 to 5: stop the cause. Pause billing for the trips or the service level involved while you work out what went wrong.
Days 5 to 30: scope it. Find every claim with the same cause within the lookback period. When there are too many to review one by one, draw a statistically valid sample. HHS OIG’s free RAT-STATS software is built for that, and the Medicare rule requires describing the sampling method in any report that uses one.
Days 30 to 40: quantify by payer. Total the overpayment separately for the state, each broker, and each plan.
Days 40 to 45: choose the route. Void or adjust for routine errors, a state self-disclosure for larger or systemic ones, or legal advice and a formal protocol where fraud is possible.
By day 60: report and return. Send the written explanation and the repayment, or the disclosure that pauses the deadline under your state’s program.
After: fix and document. Retrain staff, change the process, and keep a corrective action plan on file.

Keep the whole file: the date of identification, your analysis, every message with the payer, and proof of repayment. If an auditor later asks, that file shows you met the rule. Our NEMT fraud prevention guide covers the compliance program that catches these errors early, and Medicaid audits of NEMT providers covers what happens when an auditor finds them first.

Catching billing mistakes early

Many overpayments begin as a gap between what was billed and what happened on the road. For each trip, HealthRide saves the GPS-recorded miles, the pickup and drop-off timestamps, the rider’s signature, and the wait time logged on any no-show. Checking the trip log in reports against what you billed each month is a simple way to find those gaps well inside 60 days.

The 60-day rule for Medicaid overpayments: what NEMT providers must report and return